Making sense of The Local Vocal

Risk levels

Risk reflects a blend of how likely you are to encounter something and how much harm it could do — our team sets it for every alert.

Threat Type — the harm

What the attack is ultimately trying to do to you. The Local Vocal uses twelve curated categories.

Account Takeover

An attacker gains control of a legitimate account — email, Microsoft 365, banking or SaaS — then uses that access to steal data, move funds or launch further attacks from inside.

Adware

Software (often bundled with free downloads or delivered via malvertising) that forces unwanted ads, hijacks browser search or tracks your browsing habits. Rarely destructive on its own, but a strong signal the device has been compromised.

Data Breach

Unauthorised access to or disclosure of confidential information — customer records, credentials, financial data or intellectual property. Often the end goal of an account takeover, ransomware attack or supply-chain intrusion.

Denial of Service

An attack designed to overwhelm a website, network or service so legitimate users can't access it (DoS / DDoS). Frequently used as extortion leverage — or as a smokescreen while another attack runs in the background.

Email Compromise

The attacker either impersonates or has taken over an internal mailbox and uses it to redirect payments, change invoice details, or extract sensitive information from colleagues and suppliers.

Malicious Link

A URL crafted to steal credentials, harvest data, or silently install harmful software when a target clicks it — typically embedded in a phishing message, SMS or ad.

Malware

Umbrella term for any malicious software — trojans, worms, viruses, keyloggers, remote-access tools, botnet clients. Can be delivered by any vector (email attachment, USB, drive-by download, supply-chain update).

Phishing

Fraudulent messages that trick you into revealing passwords, card details or other information by pretending to come from someone you trust (bank, IRD, Microsoft, colleague).

Scam/Fraud

Deception designed to trick you out of money, goods or services — invoice fraud, fake refunds, tech-support scams, romance/investment schemes and similar.

Social Engineering

Manipulation of people — through urgency, authority, sympathy or trust — into acting against their own interest (approving an MFA prompt, sharing a code, transferring funds).

Spyware

Malware that silently monitors what you do — keystrokes, screen contents, camera/microphone, browser sessions — and exfiltrates it to the attacker. Common tool for stealing banking credentials and live MFA codes.

Ransomware

Malware that encrypts your files and demands payment for the decryption key. Modern variants also steal data first and threaten to publish it (double-extortion) whether you pay or not.

Encountered Via — where you'd meet it

The channel a reader would first encounter this threat. One of nine taxonomies.

Email

The threat first reaches you in your inbox — a message, link or attachment designed to trick, infect or defraud you.

Social Media

The threat first surfaces on a social platform (Facebook, Instagram, LinkedIn, TikTok) — usually as a fake ad, sponsored post, impersonated brand page or a DM from a compromised contact.

Sign-ins

The threat targets your login screens directly — automated password-guessing, credential stuffing, MFA-fatigue prompts or infrastructure probing against Microsoft 365 / Google Workspace / VPN portals.

Website / Web search

The threat is discovered by browsing or via a search engine — a poisoned result, malicious ad, fake support number, or a look-alike company page that ranks alongside the legitimate one.

SMS / Text

The threat arrives by text message — a fake courier notice, bank alert, IRD refund or MFA prompt that links to a scam page (sometimes called "smishing").

Phone call

Voice-based social engineering — tech-support scams, spoofed bank fraud calls, IRD impersonation, or robocalls that pressure you into paying or handing over codes.

Application

A software vulnerability being actively exploited in a product your business uses — anchored by a specific CVE (Common Vulnerabilities and Exposures) identifier so you can look up and patch it.

Supply chain

Attackers reach you through a trusted upstream vendor or software update pipeline. You're not the direct target — a supplier is — but the compromise flows downstream to your systems.

Removeable media

Malware carried on USB sticks, SD cards or external drives — the classic "lost USB in the carpark" or infected vendor drive. Bypasses email and web defences entirely.

Reading a threat card — the technical detail

Some alerts include structured evidence. Here's what each of those panels means.